CWE-310: Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
From the CWE List. © The MITRE Corporation.
Newest
- cisco anyconnect secure mobility clientThe IPsec implementation in Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not...5.8 Medium
- bitcoin wxbitcoin, core +1 moreThe "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not...4.3 Medium
- iconics bizviz, genesis32 +1 moreThe lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and...4.4 Medium
- airdroidAirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as...5.0 Medium
- apache hadoopClient BlockTokens not checked in Apache Hadoop7.5 High
- moodlelib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct...4.3 Medium
- elitecore cyberoam unified threat management** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification...5.8 Medium
- fedoraproject 389 directory server, redhat directory server +1 more389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the...2.1 Low
- fedoraproject 389 directory server, redhat directory server +1 more389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the...1.2 Low
- mikel olasagasti revelationThe fpm exporter in Revelation 0.4.13-2 and earlier encrypts the version number but not the...2.1 Low
- apache commons compressUncontrolled Resource Consumption in Apache Commons Compress5.0 Medium
- opensslThe Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does...4.0 Medium
- polarsslThe Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not...4.0 Medium
- innominate mguard firmwareThe Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS,...7.1 High
- dlitz pycryptoPyCrypto makes Use of Insufficiently Random Values4.3 Medium
- poul-henning kamp md5cryptPoul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short...5.0 Medium
- freebsd, php, postgresql +1 more +3 moreThe crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP,...4.3 Medium
- opera browserOpera before 9.63 does not properly verify X.509 certificates from SSL servers, which allows man...5.8 Medium
- apple mac os x, mac os x server +1 morelibsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys...6.4 Medium
- ibm rational appscanThe Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does...5.8 Medium
- ibm websphere application serverThe Web Server Plug-in in IBM WebSphere Application Server (WAS) 8.0 and earlier uses unencrypted...6.8 Medium
- siemens ruggedcom rugged operating systemRuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password...8.5 High
- nttdocomo spmode mail androidThe NTT DOCOMO sp mode mail application 5400 and earlier for Android does not properly verify X...5.8 Medium
- maian galleryGallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has...10.0 High
- ibm tivoli directory serverThe default configuration of TLS in IBM Tivoli Directory Server (TDS) 6.3 and earlier supports...6.4 Medium
- rubygemsRubyGems does not verify SSL certificate4.3 Medium
- realnetworks helix mobile server, helix server +1 moreRealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext...2.1 Low
- cloudera manager, service and configuration manager +1 moreCloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is...6.5 Medium
- apache hadoop, cloudera cdh +1 moreApache Hadoop allows impersonation of arbitrary cluster user accounts6.5 Medium
- cisco ios, ios xe +1 moreThe SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1, and 15.2 and IOS XE 2.3.x through 2...7.8 High
- cisco ios, ios xe +1 moreThe IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x...7.5 High
- gnu gnutlsgnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly...5.0 Medium
- opensslThe implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and...5.0 Medium
- mumbleMumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble...2.1 Low
- apple mac os x, mac os x server +1 moreAddress Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon...4.3 Medium
- opensslcrypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other...5.8 Medium
- apache tomcatUse of Hard-coded Cryptographic Key in Apache Tomcat4.3 Medium
- gnome glib** DISPUTED ** GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash...5.0 Medium
- gnu gnutlsThe DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if...4.3 Medium
- opensslThe SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly...5.0 Medium
- opensslThe DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only...4.3 Medium
- rack project rackRack Gem Subject to Denial of Service via Hash Collisions5.0 Medium
- mortbay jetty, oracle sun storage common array manager +1 moreImproper Input Validation in Jetty5.3 Medium
- d-link dir-300 router, dlink dir-300 firmware +1 moreThe D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to...6.8 Medium
- parallels plesk small business panelParallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which...5.0 Medium
- parallels plesk panelThe billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not prevent the use...5.0 Medium
- parallels plesk panelThe billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not disable the SSL 2...5.0 Medium
- parallels plesk panelThe Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password...5.0 Medium
- opera browserOpera before 11.60 does not properly handle certificate revocation, which has unspecified impact...10.0 High
- joomla joomla\!The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which...5.0 Medium
- Show moreLoading…